RegexVisualizer

Render Regulex-style railroad diagrams for a JavaScript regular expression and export the exact same SVG/PNG as the Regulex-Plus web UI (docs/index.html) "Ex...

This skill appears to do exactly what it claims: run a local Node script that loads the included Regulex HTML in a headless browser and writes SVG/PNG output. Before installing, note: (1) npm install will add puppeteer-core and its dependencies to the skill folder; (2) you must have a local Chrome/Edge installed (or set CHROME_PATH/--chrome); (3) the script launches the browser with --no-sandbox (common for headless automation) — only run it on trusted content and in a safe environment; (4) review assets/regulex.html if you have concerns about remote resource loading (the packaged file appears self-contained). If you only need simple diagram rendering and prefer fewer dependencies, consider alternative tools that don't require a headless browser, but from a coherence/security standpoint this package is consistent with its purpose.

Type: OpenClaw Skill Name: regex-visualizer Version: 1.0.0 The skill is classified as suspicious due to significant vulnerabilities in `scripts/render.mjs`. The script uses `writeFileSync` with a user-controlled `--out` argument, which, when combined with `path.resolve()`, could allow an attacker to write arbitrary SVG/PNG content to arbitrary file system locations (e.g., using `../` or absolute paths). Additionally, the `--chrome` argument allows specifying an executable path for the headless browser, which could lead to Remote Code Execution if a malicious path is provided. While there is no clear evidence of intentional malicious behavior like data exfiltration or persistence, these vulnerabilities present a high risk of abuse.